Threat Intelligence Report October 29 - November 4 2024

Play Ransomware Analysis

Play ransomware, emerging as one of the most active threat actors with 12.26% of total attacks in our recent analysis, has gained significant attention due to its collaboration with North Korean state-sponsored actors. This partnership marks a concerning evolution in ransomware operations, blending cybercrime with state-sponsored capabilities.

Play Ransomware: North Korean State Actor Connections

Key Connection Points

1. Infrastructure Overlap

• Shared Command-and-Control (C2) infrastructure with North Korean APT groups
• Common IP addresses used in attacks (68.235.184[.]54)
• Identical server configurations and malware deployment patterns

2. Technical Similarities

• Use of Tactics, Techniques, and Procedures (TTPs) similar to UNC4899
• Deployment of DPRK-linked malware alongside Play ransomware
• Common exploitation of vulnerabilities like ProxyNotShell and OWASSRF

3. Attack Pattern Correlations

• Coordinated targeting healthcare organisations
• Similar victim selection methodology
• Synchronised timing of attacks

Detailed TTPs for Play Ransomware with North Korean Connection

1. Initial Access and Exploitation: 
   • Exploits Microsoft Exchange vulnerabilities (ProxyNotShell and OWASSRF)
   • Exploits specifically CVE-2022-41082 and CVE-2022-41040
   • Targets healthcare sector organisations predominantly
   • Deploys web shells for persistent access
2. Infrastructure and Operations: 
   • Shares C2 infrastructure with IP address 68.235.184[.]54
   • Connects with UNC4899 operations
   • Maintains common Command-and-Control servers
   • Deploys shared malware infrastructure
3. Post-Exploitation Activities: 
   • Deploys Cobalt Strike beacons for network control
   • Executes PowerShell commands for system manipulation
   • Implements BitLocker encryption for data impact
   • Performs Volume Shadow Copy Deletion
4. Lateral Movement and Persistence: 
   • Modifies Windows Registry for persistence
   • Creates scheduled tasks for maintained access
   • Installs malicious services
   • Abuses admin shares for movement
5. Data Impact and Encryption: 
   • Uses BitLocker Drive Encryption for file encryption
   • Targets system backups systematically
   • Deletes volume shadow copies
   • Implements secure data destruction methods
6. Tool Deployment and Usage: 
   • Deploys custom web shells for access
   • Uses sophisticated PowerShell scripts
   • Implements Remote Administration Tools
   • Employs shared North Korean malware variants
7. Strategic Operations: 
   • Coordinates synchronised attack timing
   • Shares attack infrastructure with DPRK actors
   • Focuses on the healthcare sector targeting
   • Implements common exploitation techniques
8. Command-and-Control: 
   • Uses shared hosting providers
   • Maintains overlapping C2 servers with DPRK operations
   • Implements sophisticated proxy mechanisms
   • Deploys coordinated control infrastructure
     

​​​​​​​

Key Characteristics:

• Emergence: Gained prominence in 2022, showing significant evolution in capabilities and reach
• Infrastructure: Maintains sophisticated infrastructure including leak sites and C2 servers
• Partnership Model: Unique collaboration with state-sponsored actors, particularly North Korean APT groups
• Technical Sophistication: Advanced encryption and evasion capabilities

Modus Operandi:

• Target Selection: 
  • Focus on high-value organisations
  • Strategic targeting of critical infrastructure
  • Preference for organizations with cyber insurance
• Attack Methodology: 
  • Sophisticated initial access techniques
  • Advanced lateral movement capabilities
  • Implementation of multiple pressure points for ransom payment
• Extortion Tactics: 
  • Multi-layered extortion approach
  • Sophisticated negotiation strategies
  • Strategic data leakage for maximum impact

Technical Observations:

• Malware Characteristics: 
  • Custom-developed encryption algorithms
  • Sophisticated anti-analysis capabilities
  • Advanced process injection techniques
• Network Infrastructure: 
  • Distributed Command-and-Control
  • Sophisticated proxy mechanisms
  • Shared infrastructure with state-sponsored actors
• Evasion Capabilities: 
  • Advanced anti-debugging features
  • Sophisticated process hiding
  • Complex obfuscation techniques

MITRE ATT&CK-based Kill Chain for Play Ransomware:

Indicators of Compromise

SHA256 Hashes

• 243ad5458706e5c836f8eb88a9f67e136f1fa76ed44868217dc995a8c7d07bf7
• 2b254ae6690c9e37fa7d249e8578ee27393e47db1913816b4982867584be713a
• f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5
• 99e2ebf8cec6a0cea57e591ac1ca56dd5d505c2c3fc8f4c3da8fb8ad49f1527e
• b4f5d37732272f18206242ccd00f6cad9fbfc12fae9173bb69f53fffeba5553f
• b1ac26dac205973cd1288a38265835eda9b9ff2edc6bd7c6cb9dee4891c9b449
  
  

Sliver C2 Server Information

• 172.96.137[.]224
• americajobmail[.]site
  
  

Code Signing Certificate Details

SHA256 hash: b4f5d37732272f18206242ccd00f6cad9fbfc12fae9173bb69f53fffeba5553f
Chain: 6e95d94d5d8ed2275559256c5fb5fc6d01da6b46
Issuer: CN=LAMERA CORPORATION LIMITED
NotBefore: 2/10/2022 9:44 PM
NotAfter: 12/31/2039 4:59 PM
Subject: CN=LAMERA CORPORATION LIMITED
Serial: 879fa942f9f097b74fd6f7dabcf1745a
Cert: 6e95d94d5d8ed2275559256c5fb5fc6d01da6b46

SHA256 hash: f64dab23c50e3d131abcc1bdbb35ce9d68a34920dd77677730568c24a84411c5
Chain: 6624c7b8faac176d1c1cb10b03e7ee58a4853f91
Issuer: CN=Tableau Software Inc.
NotBefore: 5/27/2023 11:15 AM
NotAfter: 12/31/2039 4:59 PM
Subject: CN=Tableau Software Inc.
Serial: 76cb5d1e6c2b6895428115705d9ac765
Cert: 6624c7b8faac176d1c1cb10b03e7ee58a4853f91

This list of IoCs may not be the full list managed by Red Piranha and should only be considered a sample list.